Differences

This shows you the differences between two versions of the page.

--- resolution_area:prometheus_resolutions:res-p9129 [2024/08/06 20:54] – 10.91.120.100
+++ resolution_area:prometheus_resolutions:res-p9129 [2024/08/08 18:43] (current) – 10.91.120.100
@@ Line 15: / Line 15: @@
 <code>sudo docker restart elastalert</code>
-Observe logs and be sure that the logs show elastalert running the query for both DF-80 and DF-60. These two lines should be present.
+A restart should do the trick if there was an error and this caused the application to disable the rules.
+Observe logs and be sure that the logs show elastalert running the query for both DF-80 and DF-60 and that none of them are disabled. These two lines should be present.
 <code>INFO:elastalert:Queried rule df-80 from 2024-08-06 19:41 UTC to 2024-08-06 19:52 UTC: 0 / 0 hits</code>
 <code>INFO:elastalert:Queried rule df-60 from 2024-08-06 19:41 UTC to 2024-08-06 19:53 UTC: 0 / 0 hits</code>
+This line below is showing that df-80 is disabled. Thats no good, restart the application to get it back.
+<code>INFO:elastalert:Disabled rules are: ['df-80']</code>
+Then you should see
+<code>INFO:elastalert:Disabled rules are: []</code>
+Another thing to check is the rule yaml files
+<code>cd /home/scotty/elastalert_config/rules</code>
+<code>sudo vi df-60.yaml or sudo vi df-80.yaml</code>
+Ensure the setting is_enabled is set to true.
 **Auto Clear:** Will auto clear if the elastalert_scrapes_total counter increases again

Internal Errigal Collaboration Wiki